UF_TRACKED is a flag that tells HFS to send the event to the monitored file handler in user mode for any changes to the file system (for example, renaming or deleting and changing metadata, but not changing the file). You can see this as in the header file:
#define UF_TRACKED 0x00000040
The code for processing is in the kernel, bsd / hfs / hfs_vfsutils.c:
int check_for_tracked_file(struct vnode *vp, time_t ctime, uint64_t op_type, void *arg) { int tracked_error = 0, snapshot_error = 0; if (vp == NULL) { return 0; } if (VTOC(vp)->c_bsdflags & UF_TRACKED) { ...
And called everywhere, mostly from hfs_vnops.c
source share